DEP-2025 Questions and Answers

Account-driven User Enrollment limits MDM scope. TheiOS Deployment Referencestates, "MDM can enforce policies like requiring a passcode with User Enrollment, but it cannot access location, wipe the device, or disable Activation Lock."

Administrator and People Manager roles can add Locations. TheApple Business Manager User Guidestates, "Users with the Administrator or People Manager roles have permissions to add and manage Locations in Apple Business Manager." Option D’s “Location Manager” isn’t a standard role.

802.11r enhances roaming. TheApple Platform Deployment Guidestates, "802.11r, or Fast BSS Transition, improves Wi-Fi performance by enabling faster roaming between access points, reducing authentication overhead." Option C is a QoS feature, not a standard, and A and D are unrelated.

User Enrollment separates managed Keychain items. TheiOS Deployment Referencestates, "With User Enrollment, Keychain items associated with a Managed Apple ID are stored in a distinct cryptographic container." Options B, C, and D aren’t separated unless tied to managed apps.

Bootstrap tokens authorize updates. ThemacOS Security Overviewstates, "A bootstrap token, escrowed by MDM, allows the management solution to install software updates on macOS devices without user interaction." Options A, B, and C are not bootstrap token functions.

AirDrop works with Shared iPad. TheiOS Deployment Referencestates, "Shared iPad supports features like AirDrop that don’t require a single user’s Apple ID, unlike Continuity features such as Universal Control or Sidecar."

Managed Distribution, available through Apple Business Manager (ABM) or Apple School Manager (ASM), is required to deploy books to devices using an MDM solution. Administrators purchase books in ABM/ASM, assign them to users or devices via Managed Distribution, and the MDM pushes them silently (for supervised devices) or with user consent. An Apple Developer account (option A) is for apps, not books. User acceptance (option C) may be needed for non-supervised devices but isn’t the core requirement. A VPN configuration (option D) is unrelated. TheApple Business Manager User Guideconfirms Managed Distribution for book deployment.

Skipping Location Services hides it and disables it, with admin control. ThemacOS Deployment Referencestates, "If the Location Services pane is skipped in Setup Assistant, it is hidden from the user, and the service is disabled post-enrollment. An administrator can enable it later in System Settings." Option B fits managed scenarios, unlike D which implies user control.

Skipping local account creation requires alternative login. ThemacOS Deployment Referencestates, "If ADE skips local account creation, users must log in with a network account or another pre-existing account created outside Setup Assistant." Option C is incorrect as Managed Apple IDs don’t become local accounts.

Bypass codes are stored in MDM for organization-linked Activation Lock. TheApple Platform Deployment Guidestates, "Bypass codes for organization-linked Activation Lock are stored in the MDM solution, allowing administrators to unlock devices without user credentials."

Deploying macOS configuration profiles to devices requires an MDM solution, which pushes the profiles remotely via APNs to enrolled devices, ensuring centralized management. An Apple Developer account (option A) is for app development, not profile deployment. User acceptance (option C) is needed for manual installation but not for MDM deployment, especially on supervised devices. A VPN configuration (option D) is unrelated. TheApple Platform Deployment Guidespecifies MDM as the standard method for deploying profiles to macOS devices.

Cryptographic separation isolates managed and personal data. TheApple Platform Deployment Guidestates, "Account-driven User Enrollment and Account-driven Device Enrollment provide cryptographic separation by isolating managed data (tied to a Managed Apple ID) from personal data (tied to a personal Apple ID)." A creates a managed container, and B extends this to device-level management. Options C, D, and E lack this separation.

To link a new Apple Authorized Reseller to your Apple Business Manager (ABM) or Apple School Manager (ASM) account, you must add the reseller’s Reseller Number (also known as the Apple Customer Number). TheApple Business Manager User Guidestates, "To ensure devices purchased from a new Apple Authorized Reseller appear in Apple Business Manager, add the reseller’s Reseller Number in the ‘Resellers’ section of your account settings." Option B (Organization ID) is provided to the reseller, not added in ABM/ASM, while A and C are not required for this purpose.

Managed Distribution in Apple Business Manager (ABM) and Apple School Manager (ASM) enables administrators to assign apps (purchased or free) to users or devices via an MDM solution. It replaced the legacy Volume Purchase Program (VPP, option D), integrating app purchasing and distribution into ABM/ASM. Automated Device Enrollment (option A) is for device enrollment, not app assignment. User Enrollment (option C) is a BYOD enrollment type, not an app distribution feature. TheApple Business Manager User Guidedetails Managed Distribution as the mechanism for app assignment.

Unlisted apps require a link. TheApple Business Manager User Guidestates, "Unlisted apps are published to the App Store but are discoverable only via a direct link, often for private distribution."

Apple devices come with built-in security features, such as data encryption, Secure Enclave, and passcode enforcement, which MDM solutions leverage to secure devices. These features allow MDM to enforce policies like requiring a passcode, enabling encryption, or remotely wiping a device if lost. Location Services (option A) provides geolocation data but is not a core security capability used by MDM for securing devices. Enrollment profiles (option B) are the mechanism to connect a device to MDM, not a capability that secures the device itself. TheApple Platform Security Guidehighlights how MDM utilizes these built-in features to enhance device security, making option C the correct choice.

With User Enrollment, personal and managed iCloud Drives coexist separately. TheiOS Deployment Referenceexplains, "When a device is enrolled with a Managed Apple ID via User Enrollment and iCloud Drive is enabled, an additional iCloud Drive appears in the Files app, separating personal data (linked to the personal Apple ID) from managed data (linked to the Managed Apple ID)." Option B is incorrect as data doesn’t merge, C is false as personal data remains accessible, and D doesn’t occur during this process.

In Kerberos, the Ticket-Granting Ticket (TGT) is the feature that enables single sign-on (SSO). After initial authentication, the user receives a TGT from the Key Distribution Center (KDC). The TGT is then used to obtain service tickets for accessing various resources without re-authenticating, providing a seamless SSO experience. Sign in with Apple at Work & School (option A) is an Apple-specific feature, not a Kerberos component. OAuth (option B) and SAML (option D) are separate SSO protocols, not Kerberos features. TheApple Platform Security Guideexplains the TGT’s role in Kerberos SSO.

User Enrollment, designed for Bring Your Own Device (BYOD) scenarios, separates personal and managed data on a device using a cryptographic boundary. This ensures organizational policies (e.g., managed apps, email) are isolated from personal content (e.g., photos, personal apps), protecting user privacy while allowing management. Additional restrictions (option A) are a supervision feature, not User Enrollment. App license management (option B) is tied to Managed Distribution, not enrollment type. Simplified setup (option D) aligns with ADE, not User Enrollment. TheApple Platform Deployment Guidehighlights data separation as User Enrollment’s key benefit.

Automated Device Enrollment (ADE), managed through Apple Business Manager (ABM) or Apple School Manager (ASM), is supported on iPads, iPhones, Macs, and Apple TVs purchased from Apple or authorized resellers. It enables automatic MDM enrollment and supervision during setup. Options A, B, and C are all correct, and D encompasses them, aligning with ADE’s broad compatibility as per the Apple Platform Deployment Guide.

Managed Distribution, available through Apple Business Manager or Apple School Manager, enables app license management by allowing organizations to purchase, assign, and revoke app licenses centrally. This ensures efficient use of licenses, reassignment as needed, and compliancewith licensing terms. Personalization (option A) is unrelated to distribution. Data separation (option C) is a feature of User Enrollment, not Managed Distribution. Simplified enrollment (option D) pertains to ADE, not app management. TheApple Business Manager User Guidehighlights license management as the primary benefit.

Setting up Shared iPad requires an MDM solution to configure the feature, assign Managed Apple IDs, and manage user sessions. The MDM applies a configuration profile specifying Shared iPad settings (e.g., temporary session mode or user-specific logins) and integrates with Apple School Manager or Apple Business Manager. Apple Configurator (option B) can supervise devices but isn’t required for Shared iPad setup. User Enrollment (option C) is for BYOD, not shared devices. A VPN configuration (option D) is unrelated. TheApple Platform Deployment Guidemandates MDM for Shared iPad deployment.

Federated Authentication allows administrators to link Apple School Manager or Apple Business Manager with identity providers like Google Workspace or Azure AD, streamlining Managed Apple ID creation by syncing user data (e.g., names, emails). Users can then sign in with their existing credentials, leveraging SSO. MSCHAPv2 (option A) is a VPN authentication protocol, not relatedto ID creation. Active Directory (option C) is an IdP but not the feature itself. SAML (option D) is a protocol used in federation, but “Federated Authentication” is the broader Apple feature. TheApple Platform Deployment Guidedetails this process.

Apple Configurator, a macOS application, allows administrators to supervise Apple devices (iOS, iPadOS, tvOS) by connecting them via USB. Supervision enables additional restrictions and management capabilities (e.g., blocking app removal) beyond standard MDM. Apple Business Manager (option A) and Apple School Manager (option C) manage enrollment and content but don’t supervise devices directly. Managed Apple IDs (option D) are accounts, not supervision tools. TheApple Platform Deployment Guidehighlights Apple Configurator’s role in supervision.

The Wi-Fi payload supports Cisco Fastlane QoS. TheMobile Device Management Protocol Referencestates, "The Wi-Fi payload supports Cisco Fastlane QoS settings, allowing administrators to prioritize traffic for critical applications on macOS devices." Options A, B, and D serve different purposes.

MDM manages beta enrollment. TheMobile Device Management Protocol Referencestates, "MDM can enroll devices in the Apple Beta Software Program by pushing a profile with beta update settings."

Apple Configurator for Mac allows administrators to create Blueprints, which are templates for configuring devices with settings, apps, and profiles. TheApple Configurator User Guideexplains, "Apple Configurator for Mac allows you to create Blueprints—templates containing settings, apps, and profiles—that can be applied to iPhones, iPads, or Macs during configuration." Option A is an MDM feature, B requires MDM for over-the-air updates, and D is handled via Apple Business Manager, not Configurator.

Configuration profiles enable IT administrators to manage app installation settings on a device, such as restricting the App Store, preventing app removal, or enforcing an allow list of approved apps. These profiles are deployed via MDM or manually, ensuring control over app usage. Find My (option B) and iCloud (option C) are user-focused features unrelated to app installation management. MDM (option D) is the delivery mechanism, but the profiles define the settings. TheApple Platform Deployment Guidedetails app installation control via configuration profiles.

Apple Business Manager (ABM) uses a device’s serial number to identify devices purchased from Apple or an authorized reseller for enrollment in Automated Device Enrollment (ADE). Serial numbers are unique to each device and linked to purchase records, allowing ABM to verify eligibility. Order numbers (option A) track purchases but aren’t device-specific identifiers in ABM. UDID (option C) and UUID (option D) are unique identifiers for devices or instances, but they’re not used for purchase verification in ABM. TheApple Platform Deployment Guideconfirms serial numbers as the key identifier in ABM.

The public key generates the server token. TheApple Business Manager User Guidestates, "To generate a server token for ADE, download the public key from your MDM solution and upload it to Apple Business Manager." Option C is never shared, and B and D serve different purposes.

Apple School Manager (ASM) enables educational content management by allowing administratorsto purchase and distribute apps, books, and other resources to students and staff via Managed Distribution. It’s tailored for schools, integrating with MDM and Shared iPad. Personalization (option A) is user-driven, not an ASM benefit. Data separation (option C) is a User Enrollment feature. Simplified setup (option D) is a byproduct of ADE, not ASM’s primary focus. TheApple Platform Deployment Guidehighlights content management as ASM’s key benefit.

The nonpersonalized, organization-owned model is designed for shared or single-purpose devices, such as Shared iPads in education or kiosks in businesses. In this model, IT administrators centrally configure and manage the devices, restricting installed apps and personal data to ensure consistency and security across multiple users. BYOD, User Enrollment (option A) and BYOD, personally enabled (option B) involve personal devices with user control, not shared use. Personally enabled, organization-owned (option D) allows personalization, unsuitable for shared scenarios. TheApple Platform Deployment Guidedetails this model for shared device management.

Configuration profiles, deployed via MDM or manually, allow IT administrators to restrict apps on a device by setting policies such as blocking the App Store, preventing app removal, or allowing only specific apps (e.g., via an allow list). These profiles are highly customizable for security and compliance. Activation Lock (option A) secures device reactivation, not app restrictions. Find My (option C) and iCloud (option D) are user-focused features without app restriction capabilities. TheApple Platform Deployment Guidedetails configuration profiles’ role in app management.

Shared iPad requires Managed Apple IDs, created via Apple School Manager (ASM) or Apple Business Manager (ABM), to enable multiple users to log in with separate sessions. These IDs are organization-controlled and integrate with MDM for session management. Personal Apple IDs (options A and C, the same) are for individual use and incompatible with Shared iPad. There’s no “Shared Apple ID” (option D); Shared iPad uses individual Managed Apple IDs or temporary sessions. TheApple Platform Deployment Guidemandates Managed Apple IDs for Shared iPad.

Content caching on a Mac improves network performance by storing frequently accessed content (e.g., app updates, iCloud data) locally, reducing internet bandwidth usage and speeding up downloads for connected devices. It doesn’t enhance security (option A), separate data (option C, a User Enrollment feature), or simplify enrollment (option D, an ADE benefit). TheApple Platform Deployment Guideemphasizes bandwidth optimization as the primary benefit of content caching.

The Organization ID links purchases. TheApple Business Manager User Guidestates, "Provide your Organization ID to the reseller to ensure devices are assigned to your Apple Business Manager account."

Configuration profiles enable IT administrators to manage passcode settings on a device, enforcing policies such as minimum length, complexity (e.g., alphanumeric), maximum age, and failed attempt limits. These profiles are deployed via MDM or manually, ensuring security compliance. Find My (option B) and iCloud (option C) are user-focused features unrelated to passcode management. MDM (option D) is the system that delivers profiles, but the profiles themselves define the settings. TheApple Platform Deployment Guidedetails passcode policy enforcement via configuration profiles.

Licenses can be transferred within an organization. TheApple Business Manager User Guidestates, "Licenses for purchased apps can be transferred to another location within the same organization in Apple Business Manager." Options B, C, and D are incorrect as free content doesn’t require negotiation, assignment isn’t automatic, and multiple roles can purchase.

User Enrollment is designed for Bring Your Own Device (BYOD) scenarios, separating personal and managed data on the device. It uses a Managed Apple ID to apply organizational policies (e.g., managed apps) while leaving personal data (e.g., photos, personal apps) untouched, leveraging a cryptographic separation. Automated Device Enrollment (option A) is for organization-owned devices with full control, not BYOD. Device Enrollment (option B) applies to organization-owned or manually enrolled devices without inherent data separation. TheApple Platform Deployment Guidedetails User Enrollment’s privacy-focused approach for BYOD.

Configuration profiles allow IT administrators to manage iCloud settings on a device, such as enabling/disabling iCloud Drive, restricting backups, or limiting document sync. These profiles are deployed via MDM or manually, providing granular control over iCloud features. Find My (option B) is a user-facing tracking feature, not a management tool. iCloud Backup (option C) is a specific iCloud service, not a management feature. MDM (option D) is the system that deploys profiles, but the profiles themselves contain the settings. TheApple Platform Deployment Guidedetails configuration profiles’ role in iCloud management.

Lost Mode, an MDM feature for supervised devices, allows device tracking by locking the device, displaying a custom message, and reporting its location (if Location Services are enabled). It’s a security tool for recovering lost or stolen devices. Additional restrictions (option B) are a supervision feature, not Lost Mode’s benefit. Network performance (option C) and data separation (option D) are unrelated. TheMDM Protocol Referencehighlights tracking as Lost Mode’s primary benefit.

Supervision, applied via Apple Configurator or ADE, enables additional restrictions on devices, such as blocking app removal, enforcing single-app mode, or managing Activation Lock, providing greater control for organizations. Personalization (option A) is more limited under supervision. Network performance (option C) is unrelated, and data separation (option D) is a User Enrollment feature. TheApple Platform Deployment Guidehighlights supervision’s enhanced management capabilities.

To ensure Apple devices can access APNs and other Apple services (e.g., App Store, iCloud), network configurations must allow outbound traffic to Apple’s network, specifically the 17.0.0.0/8 IP block on TCP port 5223 (with 443 as a fallback). This requires adjusting firewalls or web proxies to permit this traffic, as many organizational networks restrict outbound connections. VPN access (option A) is unnecessary and impractical for all devices. SSO payloads (option B) manage authentication, not network access to Apple services. Bonjour (option D) is for local device discovery, not APNs connectivity. TheApple Platform Deployment Guideprovides these networkrequirements.

Custom local networks and public IP settings span subnets. ThemacOS Deployment Referencestates, "To optimize bandwidth across subnets, use ‘Cache content for devices using custom local networks’ to specify multiple subnets and ‘devices using the same public IP address’ for broader reach."

A Wi-Fi profile aids Return to Service. TheApple Configurator User Guidestates, "When preparing a device for Return to Service, you can optionally include a Wi-Fi profile to ensure automatic network connection post-erase."

To support network roaming—where devices maintain connectivity while moving throughout a building—evaluating Wi-Fi coverage and capacity is essential. This involves assessing signal strength, bandwidth availability, and the ability of the wireless network to handle multiple devices seamlessly. Proper placement and power of access points ensure uninterrupted service. Number of devices per user (option A) is unrelated to roaming. Adequate access points per device (option C) is a specific detail within coverage and capacity, not the overarching aspect. Sources of interference (option D) is a factor to consider but secondary to overall coverage and capacity. TheApple Platform Deployment Guidestresses Wi-Fi infrastructure evaluation for mobility needs.

Server tokens expire annually. TheApple Business Manager User Guidestates, "The MDM server token expires every 12 months and must be renewed to maintain enrollment functionality."

ADE enables supervision. TheApple Platform Deployment Guidestates, "Automated Device Enrollment automatically supervises devices during setup when linked to Apple Business Manager."

Post-deadline, updates install automatically. TheMobile Device Management Protocol Referencestates, "If a user defers a managed software update past the MDM-enforced deadline, macOS will automatically install it to ensure compliance."

Configuration profiles allow IT administrators to manage Bluetooth settings, such as disabling Bluetooth entirely or restricting pairing with specific devices, enhancing security and compliance. These profiles are deployed via MDM or manually. Find My (option B) and iCloud (option C) are unrelated to Bluetooth management. MDM (option D) delivers profiles, but the profiles define the settings. TheApple Platform Deployment Guidedetails Bluetooth configuration via profiles.